I have an Atmel 97SC3201 in my computer and set the following in the kernel:


/dev has tpm0 and hwrng, but running this command returns the following:

head -c 2 /dev/hwrng


head: error reading ‘/dev/hwrng’: Input/output error

In dmesg these messages appear:

tpm_atmel tpm_atmel: A TPM error (2048) occurred attempting get random

additional tries yield these messages:

tpm_atmel tpm_atmel: A TPM error (6) occurred attempting get random

Any ideas why this fails or better, how to get it working?

  • 1
    Can you read from it other ways? – Ignacio Vazquez-Abrams May 25 '13 at 19:26
  • What other ways are there? – sam May 25 '13 at 19:55
  • cat, dd, od, etc. – Ignacio Vazquez-Abrams May 25 '13 at 19:56
  • All those programs report "input/output error". – sam May 25 '13 at 20:00
  • 1
    Have you enabled the TPM in the BIOS, and have you installed tpm-tools so that the TPM is initialized at boot time? – Gilles May 25 '13 at 22:13

This RNG comes as part of a Trusted Platform Module. Unless your computer was part of an order for a large organization, the TPM is disabled by default, because it can make your computer unbootable if misconfigured, and because it can make your computer more traceable¹.

If you want to use the RNG, you'll have to enable it in the BIOS. The Thinkpad wiki has detailed instructions for a Thinkpad, which may still help with adaptations if you have another model. I'm not sure if it's enough to enable the TPM in the BIOS or if you also need to initialize it from Linux at boot time. If you need Linux support, install TrouSerS (most distributions should have a package for it).

You can use other things from the TPM, mainly secure boot (so that even someone with root access to your machine can't infect the bootloader to plant a rootkit²). You need Trusted Grub for secure boot.

Note that Linux has a good built-in cryptographic-quality pseudo-random number generator, and is good at collecting entropy to seed that PRNG. So the benefit from a hardware RNG is very limited.

¹ More precisely, a TPM gives your computer a hard-to-spoof identity that you can't easily deny. This would be a major privacy concern, but it is in fact a lot less of a problem than popularly perceived. Software using the TPM correctly does not send your computer's identity to remote parties, but use an application-specific key that isn't traceable to the TPM — so it's like having an account with the third party, no more. Software using the TPM incorrectly can expose your privacy, but so can any software — browsers are famous for revealing a lot of things about you. Everyday web browsing exposes far more than what you risk from a TPM.
² But note that there are other places to plant a rootkit. A TPM can only really provide protection if you lock the system down so much that it's hard to install any extra software.


These are the steps from the thinkwiki site for enabling TPM.

Using the TPM in Linux

excerpt from Embedded Security Subsystem on the ThinkWiki website

  • This section is very incomplete, but here are some pointers to get you started: Compile a 2.6.23 or later kernel with the driver for the tpm chip in your ThinkPad model enabled;
  • You need to enable CONFIG_SECURITY to get securityfs, and CONFIG_KEYS to use eCryptfs TPM support;
  • You need to enable tpm_bios to access the TCPA log;
  • Make sure to mount the securityfs filesystem on /sys/kernel/security to access tpm_bios data (the TCPA log);
  • You should use dm-crypt to have an encrypted swap partition with an ephemeral key;
  • The TCPA log can be found in the securityfs directory, and it might help you understand how the BIOS and boot loaders are using the PCRs. The first number for each event in the log is the number PCR register that was extended by that event;
  • You need an up-to-date version of the TrouSerS software stack to use the TPM for anything other than reading the TPCA log;
  • You need an up-to-date eCryptfs userspace (with TPM support compiled in) to use the TPM to store filesystem keys;
  • Using the TPM as a PKCS11 token is possible, but I have no idea how safe it is, since that requires a null (well-known) SRK;
  • trusted-grub can be used to play with the PCRs before Linux loads, and to checksum the Linux kernel and extend a PCR with that data;
  • The PCRs can be read through sysfs, under the /sys/bus/platform/devices/tpm*/pcrs file for the TPM driver for your TPM chip;
  • TrouSerS 0.3.1 tpm_getpubek seems not to work too well, it gets the PUBEK attributes wrong from the NSC TPM chip in a T43 (but the key data itself is correct). Compare to sys/bus/platform/devices/tpm*/pubek to check yours.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.